Detection of anomalies in data is a core technology with broad applications: detection of cardiac arrhythmias in ECG data, discovering semiconductor defects from plasma-etch data, detecting network faults from traffic data, ascertaining user interface design defects from user data, etc. Over the last dozen years, another application has emerged: detection of unauthorized or malicious users on computer hosts and networks, often called intrusion detection.
Intrusion detection systems are usually based on logical or physical attacks on a network infrastructure. However, business transactions are also a source of intrusions, and these intrusions generally go unnoticed because of the lack of security features built into systems that support business transactions.
For example, computer applications are created having several layers with each layer including detective, preventive, and corrective controls. At the business transaction layer, the detective controls are usually limited to known business rules used for supervisory type reports. The prioritization and volume of these reports along with the high error rate associated with human review results in so-called “authorized fraud.” Significant fraud, whether a “salami attack” (i.e., a series of small computer crimes—slices of a larger crime—that are difficult to detect and trace) or high dollar fraud, thus goes undetected until possible financial audits.